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REMARKS 



The Examiner has rejected Claims 1-7, 9-16 and 18-34 under 35 U.S.C. 102(e) as 
being anticipated by Foss et al. (U.S. Patent No, 6,1 19,231). Applicant respectfully 
disagrees with such rejection, especially in view of the amendments made hereinabove to 
each of the independent claims. Specifically, applicant has amended independent Claims 
1 and 10 to substantially incorporate the subject matter of dependent Claims 4-5 and 13- 
14 respectively. 



With respect independent Claims 1 and 10, the Examiner has relied on the 
following excerpts from Foss to make a prior art showing of applicant's claimed 
"comparison module checking the contents of each address field against the blocking 
rules to screen infected messages and identify clean messages" (see this or similar, but 
not identical, language in each of the foregoing claims). 



"The device first checks whether the e-mail message is being sent 
through a known protocol in step 320. The particular mail server 
protected by the mail guard device will recognize data messages 
sent only through particular protocols.* (Col. 4, lines 30-34- 
emphasis added) 

*All e-mail messages must be formatted according to a certain 
mail or data transfer protocol. Because the port address is 
contained in the beginning of the packet, the protocol can be 
determined by the scanner soon after it starts scanning the 
packet. For example, if it detects a port address of 25, the 
Simple Mail Transfer Protocol (SMTP) port in the TCP/IP protocol, 
it will expect the message to be an e-mail message formatted 
according to SMTP. In another example, if it detects a port 
address of 21 it will expect the data to be transferred under 
another protocol referred to as the File Transfer Protocol 
(FTP) . * (Col. 5, lines 17-26- emphasis added) 

Applicant respectfully asserts that the above excerpts from Foss simply teach 
determining whether the protocol of the message is known, and formatting the messages 
according to a certain protocol (see emphasized excerpt above). Clearly, checking the 
protocol of a message does not meet applicant's specifically claimed "checking the 
contents of each address field against the blocking rules " (emphasis added) since a 
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protocol is merely the format of the message and does not include the actual content of 
the message header or body. Further, Foss also does not teach that such checking is done 
in order "to screen infected messages and ^entity clean messages" (emphasis added). 
Foss's disclosure merely makes sure the protocol of the message is formatted in a 
recognized protocol before sending the message on to the recipient. 

In addition, the Examiner has relied on the following excerpt from Foss to make a 
prior art showing of applicant's claimed "intermediate message queue staging each such 
clean message pending further processing" (see this or similar, but not identical, language 
in each of the foregoing claims). 

-Following the normal flow of operations, if the e-mail 
corresponds to a known protocol, the system will invoke a rule 
set containing rules based on the protocol in step 406. One of 
the primary functions of the rule set is to inform the system 
during the scanning which characters, symbols (and certain ^ 
sequences thereof), and commands, are not allowed in an e-mail. 
(Col. 5, lines 35-41) 

Applicant respectfully asserts that simply nowhere in the above excerpt from 
Foss, nor the entire Foss reference, is there any disclosure of a queue, let alone a queue in 
the context of applicant's claims. Specifically, Foss merely teaches that once an e-mail is 
determined to have a known protocol, the system scans the e-mail for certain characters, 
symbols and commands that are not allowed, and does not teach that the e-mail is placed 
in a queue before being scanned for the certain characters. Thus, Foss clearly does not 
meet applicant's specific claim language. 

With respect to independent Claims 20 and 27, the Examiner has relied on the 
following excerpts from Foss to make a prior art showing of applicant's claimed 
"comparison module comparing the tokens to characteristics indicative of at least one of 
a computer virus and malware to identify screened incoming message packets, and 
forwarding each screened incoming message packet" (see this or similar, but not 
identical, language in each of the foregoing claims). 
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*The device first checks whether the e-mail message is being sent 
through a Xnown protocol in step 320. The particular mail server 
protected by the mail guard device will recognize data messages 
sent only through particular protocols." (Col. 4, lines 30-34- 
emphasis added) 

"All e-mail messages must be formatted according to a certain 
mail or data transfer protocol. Because the port address is 
contained in the beginning of the packet, the protocol can be 
determined by the scanner soon after it starts scanning the 
packet. For example, if it detects a port address of 25, the 
Simple Mail Transfer Protocol (SMTP) port in the TCP/IP protocol, 
it will expect the message to be an e-mail message formatted 
according to SMTP. In another example, if it detects a port 
address of 21 it will expect the data to be transferred under 
another protocol referred to as the File Transfer Protocol 
(FTP) (Col. 5, lines 17 -26 -emphasis added) 

Applicant respectfully asserts that the above excerpts from Foss merely teach 
checking the protocol of a message, which again, is simply the format of the message, 
and not comparing tokens representing field values of the header of the message to 
characteristics indicative of at least one of a computer virus and malware . Simply 
nowhere in Foss is there any mention of scanning tokens representing header field values 
in a message to determine if the message contains a computer virus or malware, which is 

clear by Foss's teaching that only the protocol is checked. 

i 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in a 
single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). Moreover, the identical invention must be 
shown in as complete detail as contained in the claim. Richardson v. Suzuki Motor 
Co.868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim. 

This criterion has simply not been met by the Foss reference, for the reasons 
noted above. Nevertheless, despite such paramount deficiencies and in the spirit of 
expediting the prosecution of the present application, applicant has substantially 
incorporated the subject matter of dependent Claims 4-5 and 13-14 into independent 
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Claims 1 and 10 respectively, and dependent Claims 21 and 28 into independent Claims 
20 and 27 respectively. 



With respect to dependent Claim 4-5 et al., presently incorporated into 
independent Claims 1 and 10, the Examiner has relied on the following excerpts from 
Foss to make a prior art showing of applicant's claimed "antivirus scanner scanning each 
message in the intermediate message queue for at least one of a computer virus, malware 
and bad content" (Claim 4 et al.) and "event handler performing each scanning operation 
as an event responsive to each such clean message staged in the intermediate message 
queue" (Claim 5 et al.) (see this or similar, but not identical, language in each of the 
foregoing claims). 

w In step 4 08 the system continues scanning the e-mail data packet 
after having established a rule set. In a preferred embodiment, 
the scanning function is implemented, in part, by using a 
searching algorithm. The portions of data processed by the search 
algorithm are determined according to the protocol. The algorithm 
may begin processing the data byte by byte and may increase to 
word by word and to long- word by long-word. The algorithm is 
typically more efficient if the compare function component in the 
algorithm can load and compare comparatively large portions of 
data at a time. Thus, depending on how the data is parsable, the 
scanning operation may become more efficient as more data is read 
or once a particular command or string is detected." (Col, 5, 
lines 52-64) 

"The present invention employs various process steps involving 
data stored in computer systems . These steps are those requiring 
physical manipulation of physical quantities. Usually, though not 
necessarily, these quantities take the form of electrical or 
magnetic signals capable of being stored, transferred, combined, 
compared, and otherwise manipulated. It is sometimes convenient, 
principally for reasons of common usage, to refer to these 
signals as bits, values, elements, variables, characters, data 
structures, or the like." (Col. 7, lines 58-67) 



Applicant respectfully asserts tliat the above excerpts from Foss completely fail to 
disclose any sort of "antivirus scanner," as claimed by applicant. In fact, the above 
scanning taught by Foss relates to scanning for certain characters, symbols and 
commands (see Col. 5, lines 35-51), and not to antivirus scanning. In addition, Foss also 
fails to teach that the antivirus scanning is performed in response to the header of the 
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message being determined to be clean based on a comparison with blocking rules (see 
independent claims from which the foregoing claims depend). 

With respect to dependent Claim 21 et al., presently incorporated into 
independent Claims 20 and 27, the Examiner has relied on the following excerpt from 
Foss to make a prior art showing of applicant's claimed "antivirus scanner scanning the 
message content of the body of each screened incoming message packet for at least one 
of a computer virus and malware to identify uninfected screened incoming message 
packets, and forwarding each uninfected screened incoming message packet" (see this or 
similar, but not identical, language in the forgoing claims). 

w In step 410, the system determines whether the e-mail contains 
an acceptable or OK command, if the e-mail contains an OK command 
the system continues with steps following 42 0 where the e-mail 
message-data (i.e. the actual message portion of the e-mail) is 
checked. If the e-mail does not contain an OK command, the system 
continues with step 412. « (Col. 6, lines 1-7) 

Applicant respectfully asserts that the above excerpt from Foss merely teaches 
checking whether the commands in an e-mail are allowed. Clearly this does not rise to 
the level of applicant's claim language, since applicant specifically claims scanning the 
message for at least one of "a computer virus and malware." Nowhere in Foss is there 
even any mention of scanning for a computer virus or malware in the manner claimed by 
applicant. 

Applicant further notes that the prior art is also deficient with respect to the 
dependent claims. For example, with respect to dependent Claim 23, the Examiner has 
relied on Foss's teaching of sending a rejection message or similar notification to the 
source of the message if the protocol of the message is determined to be unknown. 
Applicant respectfully asserts that simply sending back a message to the sender of a 
message does not meet applicant's claim language since applicant specifically claims 
"clos[ing] the open connection to the sending client." Thus, in Foss, the sender could 
keep sending messages, whereas applicant claims that the connection is closed. 
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Still yet, applicant brings to the Examiner's attention the subject matter of new 
Claims 35-40 below, which are added for full consideration: 

"wherein the antivirus scanner scans content of a body of the message and 
any attachments" (see Claim 35); 

"wherein the intermediate message queue is maintained at a constant size" 
(see Claim 36); 

"wherein the constant size is determined according to a progress of the 
antivirus scanner in order to prevent the intermediate message queue from 
becoming overloaded with the messages awaiting scanning" (see Claim 37); 

"wherein the infected messages are blocked from entering the intermediate 
message queue immediately alter the comparison is made between the blocking 
rules and the contents of at least one of the address fields" (see Claim 38); 

"wherein the infected messages are discarded immediately after being 
blocked from entering the intermediate message queue" (see Claim 39); and 

"wherein a connection to a sender of the incoming message is closed if the 
message is blocked" (see Claim 40). 

A notice of allowance or a specific prior art showing of such claim features, in 
combination with the remaining claim elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 
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In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P390/01 .087.02). 



P.O. Box 721120 R^stration No. 41,429 

San Jose, CA 95172-1 120 
408-505-5100 
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